Skip to content

Product

debian/finit vulnerabilities

2 published CVES affecting debian/finit, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest debian/finit CVEs

Newest publication first

  1. CVE-2025-32022 Finit has heap based buffer overwrite in urandom.so plugin

    Published
    MediumCVSS 4.6

    Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so t...

  2. CVE-2025-29906 Finit bundled getty can bypass /bin/login

    Published
    HighCVSS 8.6

    Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the tty configuration directive that can bypass /bin/login, i.e., a user can log in as any user without authentication. This issue has been patch...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.